masks-server 0.7.0

data/app/models/masks/server/connection.rb

@@ -0,0 +1,140 @@
+module Masks
+  module Server
+    class Connection < ApplicationRecord
+      include TenantScoped
+
+      SKEW = 60.seconds
+      DEFAULT_LIFETIME = 55.minutes
+
+      encrypts :access_token
+      encrypts :refresh_token
+
+      belongs_to :provider
+      belongs_to :actor
+
+      has_many :delegations, dependent: :destroy
+      has_many :live_delegations, -> { live }, class_name: "Delegation", inverse_of: :connection
+
+      validates :subject, presence: true,
+                          uniqueness: { scope: [ :tenant_id, :provider_id ] }
+
+      scope :live, -> { where(revoked_at: nil) }
+
+      class << self
+        def record!(provider:, actor:, identity:)
+          subject = identity["sub"].presence ||
+            raise(ArgumentError, "#{provider.name} returned no #{provider.subject_claim} to identify the account by")
+
+          connection = find_or_initialize_by(provider: provider, subject: subject.to_s)
+
+          connection.actor = actor
+          connection.label = identity.values_at("email", "preferred_username", "name").find(&:present?) || connection.label
+          connection.connected_at = Time.current
+          connection.revoked_at = nil
+          connection.revoked_reason = nil
+          connection.absorb_identity(identity)
+          connection.save!
+
+          connection
+        end
+      end
+
+      def absorb_identity(identity)
+        held = identity["email"].to_s.strip.downcase.presence
+
+        return self if held.nil?
+
+        self.email = held
+        self.email_verified = identity["email_verified"] == true
+
+        self
+      end
+
+      def signed_in!
+        update!(signed_in_at: Time.current)
+
+        self
+      end
+
+      def revoked?
+        revoked_at.present?
+      end
+
+      def revoke!(reason: "revoked", by: nil)
+        transaction do
+          update!(revoked_at: Time.current, revoked_reason: reason)
+          forget_tokens!
+
+          delegations.live.find_each { |delegation| delegation.revoke!(reason: reason, by: by) }
+        end
+
+        self
+      end
+
+      def hold!(tokens)
+        raise Delegation::Refused, "#{provider.name} returned no access token" if tokens["access_token"].blank?
+
+        store_tokens!(tokens, refresh_token: tokens["refresh_token"].presence,
+                              delegated_scopes: Scopes.join(provider.delegated_scope_list))
+
+        self
+      end
+
+      def delegable?
+        return false if revoked? || !provider.delegating? || delegated_scopes.nil?
+        return false unless Scopes.list(delegated_scopes) == provider.delegated_scope_list
+
+        refresh_token.present? || !stale?
+      end
+
+      def stale?
+        access_token.blank? || access_token_expires_at.nil? || access_token_expires_at <= SKEW.from_now
+      end
+
+      def release!
+        outcome = with_lock do
+          next :refused if revoked?
+          next :fresh unless stale?
+          next :refused if refresh_token.blank?
+
+          refreshed = provider.refresh!(refresh_token)
+          next :refused if refreshed["access_token"].blank?
+
+          store_tokens!(refreshed, refresh_token: refreshed["refresh_token"].presence || refresh_token)
+          :fresh
+        rescue Provider::Refused
+          :refused
+        rescue Provider::Unreachable
+          :unavailable
+        end
+
+        case outcome
+        when :fresh then { "access_token" => access_token, "expires_at" => access_token_expires_at, "scope" => delegated_scopes }
+        when :unavailable then raise Delegation::Unavailable, "#{provider.name} did not answer a refresh"
+        else
+          forget_tokens! unless revoked?
+          raise Delegation::Refused, "#{provider.name} no longer honours this connection; connect it again"
+        end
+      end
+
+      def forget_tokens!
+        update!(access_token: nil, refresh_token: nil, access_token_expires_at: nil, delegated_scopes: nil)
+
+        self
+      end
+
+      private
+
+        def store_tokens!(tokens, **attributes)
+          update!(access_token: tokens["access_token"], access_token_expires_at: expiry_from(tokens),
+                  tokens_refreshed_at: Time.current, **attributes)
+        end
+
+        def expiry_from(tokens)
+          seconds = tokens["expires_in"].to_i
+
+          seconds.positive? ? seconds.seconds.from_now : DEFAULT_LIFETIME.from_now
+        end
+    end
+  end
+end

data/app/models/masks/server/consent.rb

@@ -0,0 +1,70 @@
+module Masks
+  module Server
+    class Consent < ApplicationRecord
+      include TenantScoped
+
+      LONGEST = 400.days
+
+      belongs_to :actor
+      belongs_to :client
+
+      scope :live, -> { where(revoked_at: nil).where("consents.expires_at IS NULL OR consents.expires_at > ?", Time.current) }
+
+      class << self
+        def record!(actor:, client:, scopes:, audience:, details: nil)
+          consent = find_or_initialize_by(actor: actor, client: client)
+          consent.assign_attributes(scopes: "", audience: [], authorization_details: []) unless consent.new_record? || consent.live?
+          consent.revoked_at = nil
+          consent.scopes = Scopes.join(Scopes.list(consent.scopes) | Scopes.list(scopes))
+          consent.audience = (consent.audience | Array(audience)).compact
+          consent.remember(details)
+          consent.expires_at = client.consent_lifetime&.seconds&.from_now
+          consent.save!
+          consent
+        end
+
+        def covers?(actor:, client:, scopes:, audience:, details: nil)
+          consent = live.find_by(actor: actor, client: client)
+          return false if consent.nil?
+
+          Scopes.covers?(consent.scopes, scopes) &&
+            (Array(audience) - consent.audience).empty? &&
+            (details.nil? || details.covered_by?(consent.remembered))
+        end
+      end
+
+      def live?
+        revoked_at.nil? && (expires_at.nil? || expires_at.future?)
+      end
+
+      def held_details
+        authorization_details.select { |held| Time.zone.parse(held["expires_at"].to_s)&.future? }
+      end
+
+      def remembered
+        held_details.map { |held| held["entry"] }
+      end
+
+      def remember(details)
+        kept = held_details
+        return self.authorization_details = kept if details.nil?
+
+        declared = AuthorizationDetails.declared
+
+        details.entries.each do |entry|
+          lasts = declared.dig(entry["type"], "remember")
+          next unless lasts.is_a?(Integer) && lasts.positive?
+
+          kept.reject! { |held| held["entry"] == entry }
+          kept << { "entry" => entry, "expires_at" => [ lasts.seconds, LONGEST ].min.from_now.utc.iso8601 }
+        end
+
+        self.authorization_details = kept
+      end
+
+      def revoke!
+        update!(revoked_at: Time.current)
+      end
+    end
+  end
+end

data/app/models/masks/server/current.rb

@@ -0,0 +1,8 @@
+module Masks
+  module Server
+    class Current < ActiveSupport::CurrentAttributes
+      attribute :tenant, :origin, :device, :ip_address, :user_agent, :previewing, :organization,
+                :authorization_details_declared
+    end
+  end
+end

data/app/models/masks/server/declared.rb

@@ -0,0 +1,127 @@
+module Masks
+  module Server
+    class Declared
+      class Invalid < StandardError; end
+
+      TENANT_KEYS = %w[name accent_color groups apps].freeze
+      APP_KEYS = %w[preset url slug name client_id client_secret_env redirect_uris scopes allowed_groups
+                    access_token_lifetime refresh_token_lifetime].freeze
+
+      def self.apply!(path = ::Rails.configuration.masks.config_path)
+        return [] if path.blank?
+
+        new(YAML.safe_load_file(path, aliases: false) || {}).apply!
+      rescue Errno::ENOENT
+        raise Invalid, "MASKS_CONFIG names #{path}, which does not exist"
+      rescue Psych::Exception => e
+        raise Invalid, "#{path} is not YAML masks can read: #{e.message}"
+      end
+
+      def initialize(document)
+        raise Invalid, "the declared configuration must be a mapping" unless document.is_a?(Hash)
+
+        @document = document
+      end
+
+      def apply!
+        tenants.flat_map do |tenant, declared|
+          Tenant.switch(tenant) { apply_tenant(tenant, declared) }
+        end
+      end
+
+      private
+
+        def tenants
+          if @document.key?("tenants")
+            @document.fetch("tenants").map do |subdomain, declared|
+              [ Tenant.active.find_by(subdomain: subdomain) || raise(Invalid, "no tenant called #{subdomain}"), declared || {} ]
+            end
+          else
+            served = Tenant.active.to_a
+            raise Invalid, "name each tenant under tenants: when this server serves more than one" unless served.one?
+
+            [ [ served.first, @document ] ]
+          end
+        end
+
+        def apply_tenant(tenant, declared)
+          known!(declared, TENANT_KEYS, tenant.subdomain)
+
+          tenant.update!(declared.slice("name", "accent_color").compact) if declared.key?("name") || declared.key?("accent_color")
+
+          Array(declared["groups"]).each { |key, group| apply_group(key, group || {}) }
+          Array(declared["apps"]).filter_map { |key, app| apply_app(tenant, key, app || {}) }
+        end
+
+        def apply_group(key, declared)
+          group = Group.find_or_initialize_by(key: key)
+          group.update!(name: declared["name"] || group.name || key.to_s.humanize)
+
+          Array(declared["members"]).each do |identifier|
+            actor = Actor.locate(identifier) || raise(Invalid, "group #{key} names #{identifier}, who has no account")
+            group.add!(actor)
+          end
+        end
+
+        def apply_app(tenant, key, declared)
+          known!(declared, APP_KEYS, "app #{key}")
+
+          preset = declared["preset"] && (AppPreset.find(declared["preset"]) || raise(Invalid, "app #{key} names no preset called #{declared['preset']}"))
+          client = Client.find_or_initialize_by(client_id: (declared["client_id"] || key).to_s)
+          created = client.new_record?
+
+          client.assign_attributes(described(preset, key, declared).merge(dynamic: false, approved_at: client.approved_at || Time.current))
+          secret = secret_for(client, declared)
+          client.save!
+
+          Event.record!(created ? Event::CLIENT_CREATED : Event::CLIENT_UPDATED, client: client, name: client.name, declared: true)
+
+          "#{tenant.subdomain}: #{client.name} has the client secret #{secret}. It is not shown again." if secret
+        rescue ActiveRecord::RecordInvalid, AppPreset::Unusable => e
+          raise Invalid, "app #{key}: #{e.message}"
+        end
+
+        def described(preset, key, declared)
+          url = declared["url"].to_s.strip.delete_suffix("/").presence
+
+          held = {
+            name: declared["name"] || preset&.name || key.to_s,
+            client_uri: url,
+            redirect_uris: declared["redirect_uris"] || (preset ? preset.redirect_uris(base: url, name: declared["slug"]) : []),
+            allowed_scopes: Scopes.join(declared["scopes"] || preset&.scopes || %w[openid profile email]),
+            allowed_groups: Array(declared["allowed_groups"]),
+            access_token_lifetime: declared["access_token_lifetime"],
+            refresh_token_lifetime: declared["refresh_token_lifetime"],
+            consent_required: false
+          }
+
+          return held.merge(protocol: Client::FORWARD, grant_types: [], response_types: [], token_endpoint_auth_method: "none") if preset&.forward?
+
+          held.merge(grant_types: %w[authorization_code refresh_token],
+                     response_types: Client.response_types_for(%w[authorization_code]),
+                     token_endpoint_auth_method: Client::DEFAULT_AUTH_METHOD)
+        end
+
+        def secret_for(client, declared)
+          return nil unless client.secret?
+
+          named = declared["client_secret_env"]
+
+          if named
+            value = ENV[named].presence || raise(Invalid, "#{named} holds no secret for #{client.client_id}")
+            client.secret_digest = BCrypt::Password.create(value) unless client.authenticate_secret(value)
+            return nil
+          end
+
+          client.issue_secret! if client.secret_digest.blank?
+        end
+
+        def known!(declared, keys, where)
+          raise Invalid, "#{where} must be a mapping" unless declared.is_a?(Hash)
+
+          unknown = declared.keys.map(&:to_s) - keys
+          raise Invalid, "#{where} names #{unknown.join(', ')}, which masks does not read" if unknown.any?
+        end
+    end
+  end
+end

data/app/models/masks/server/delegation.rb

@@ -0,0 +1,94 @@
+module Masks
+  module Server
+    class Delegation < ApplicationRecord
+      include TenantScoped
+
+      class Refused < StandardError; end
+      class Unavailable < StandardError; end
+
+      belongs_to :client
+      belongs_to :actor
+      belongs_to :connection
+
+      has_one :provider, through: :connection
+
+      scope :live, -> { where(revoked_at: nil) }
+
+      class << self
+        def grant!(client:, actor:, connection:)
+          held = covering(client: client, actor: actor, connection: connection)
+          return held if held
+
+          delegation = create!(
+            client: client, actor: actor, connection: connection,
+            scopes: Scopes.join(connection.provider.delegated_scope_list), consented_at: Time.current
+          )
+
+          Event.record!(
+            Event::DELEGATION_GRANTED,
+            actor: actor, by: nil, client: client, provider: connection.provider.key, connection: connection.uuid
+          )
+
+          delegation
+        end
+
+        def covering(client:, actor:, connection:)
+          live.find_by(client: client, actor: actor, connection: connection)
+        end
+      end
+
+      def revoked?
+        revoked_at.present?
+      end
+
+      def revoke!(reason: "revoked", by: nil)
+        return self if revoked?
+
+        transaction do
+          update!(revoked_at: Time.current, revoked_reason: reason)
+
+          withdraw_scope! unless siblings.exists?
+
+          Event.record!(
+            Event::DELEGATION_REVOKED,
+            actor: actor, by: by, client: client, provider: connection.provider.key, connection: connection.uuid, reason: reason
+          )
+        end
+
+        self
+      end
+
+      def siblings
+        Delegation.live.where(client: client, actor: actor).where.not(id: id)
+          .joins(:connection).where(connections: { provider_id: connection.provider_id, revoked_at: nil })
+      end
+
+      def release!
+        upstream = connection.release!
+
+        update_column(:released_at, Time.current)
+
+        Event.record!(
+          Event::DELEGATION_RELEASED,
+          actor: actor, by: nil, client: client, provider: connection.provider.key, connection: connection.uuid
+        )
+
+        upstream
+      end
+
+      private
+
+        def withdraw_scope!
+          scope = connection.provider.delegation_scope
+
+          RefreshToken.live.where(client: client, actor: actor).find_each do |token|
+            token.revoke! if token.scope_list.include?(scope)
+          end
+
+          Consent.live.where(client: client, actor: actor).find_each do |consent|
+            consent.update!(scopes: Scopes.join(Scopes.list(consent.scopes) - [ scope ]))
+          end
+        end
+    end
+  end
+end

data/app/models/masks/server/device.rb

@@ -0,0 +1,145 @@
+module Masks
+  module Server
+    class Device < ApplicationRecord
+      include TenantScoped
+
+      COOKIE = "masks_device".freeze
+      LIFETIME = 400.days
+      IDLE = 5.minutes
+      UNKNOWN = "Unknown device".freeze
+
+      has_many :sessions, dependent: :nullify
+      has_many :tokens, dependent: :nullify
+      has_many :device_factors, dependent: :destroy
+
+      validates :public_id, presence: true, uniqueness: { scope: :tenant_id }
+
+      scope :newest_first, -> { order(last_seen_at: :desc) }
+      scope :allowed, -> { where(blocked_at: nil) }
+      scope :blocked, -> { where.not(blocked_at: nil) }
+      scope :agent_like, ->(pattern) { where("user_agent ILIKE ?", "%#{sanitize_sql_like(pattern.to_s.strip)}%") }
+
+      after_initialize :generate_defaults, if: :new_record?
+
+      class << self
+        def identify(public_id, user_agent: nil, ip_address: nil)
+          device = find_or_initialize_by(public_id: public_id.presence || mint)
+
+          device.seen!(user_agent: user_agent, ip_address: ip_address)
+        end
+
+        def mint
+          SecureRandom.urlsafe_base64(24)
+        end
+
+        def version
+          SecureRandom.hex(16)
+        end
+
+        def browser?(user_agent)
+          detected = DeviceDetector.new(user_agent.to_s)
+
+          return false if detected.bot?
+          return false unless detected.known?
+
+          detected.os_name.present? || detected.device_type.present?
+        end
+
+        def for_actor(actor)
+          where(id: Session.where(actor: actor).select(:device_id))
+        end
+      end
+
+      def seen!(user_agent: nil, ip_address: nil)
+        self.user_agent = user_agent if user_agent.present?
+        self.ip_address = ip_address if ip_address.present?
+        self.last_seen_at = Time.current if new_record? || last_seen_at < IDLE.ago
+
+        save! if new_record? || changed?
+        self
+      end
+
+      def label
+        name.presence || detected_label
+      end
+
+      def category
+        detected.device_type.presence || "unknown"
+      end
+
+      def known?
+        user_agent.present? && detected.known?
+      end
+
+      def browser?
+        self.class.browser?(user_agent)
+      end
+
+      def bot?
+        detected.bot?
+      end
+
+      def blocked?
+        blocked_at.present?
+      end
+
+      def block!
+        transaction do
+          update!(blocked_at: Time.current)
+          sign_out!
+        end
+      end
+
+      def unblock!
+        update!(blocked_at: nil)
+      end
+
+      def rotate!
+        update!(version: self.class.version)
+      end
+
+      def sign_out!(actor: nil)
+        held = ->(scope) { actor ? scope.where(actor: actor) : scope }
+
+        transaction do
+          rotate! unless actor && shared_beyond?(actor)
+          held.call(sessions.live).find_each(&:revoke!)
+          held.call(tokens.live).find_each(&:revoke!)
+          held.call(device_factors).delete_all
+        end
+
+        self
+      end
+
+      def shared_beyond?(actor)
+        sessions.where.not(actor: actor).exists?
+      end
+
+      def carries?(session)
+        !blocked? && session.device_version == version
+      end
+
+      def remembers?(actor, factor)
+        DeviceFactor.satisfied?(device: self, actor: actor, factor: factor)
+      end
+
+      private
+
+        def detected
+          @detected ||= DeviceDetector.new(user_agent.to_s)
+        end
+
+        def detected_label
+          named = [ detected.name, detected.os_name ].map(&:presence).compact
+
+          named.any? ? named.join(" on ") : UNKNOWN
+        end
+
+        def generate_defaults
+          self.public_id ||= self.class.mint
+          self.version ||= self.class.version
+          self.last_seen_at ||= Time.current
+        end
+    end
+  end
+end

data/app/models/masks/server/device_factor.rb

@@ -0,0 +1,39 @@
+module Masks
+  module Server
+    class DeviceFactor < ApplicationRecord
+      include TenantScoped
+
+      SECOND_FACTOR = "second_factor".freeze
+      LIFETIME = 30.days
+
+      belongs_to :device
+      belongs_to :actor
+
+      scope :live, -> { where("expires_at > ?", Time.current) }
+
+      class << self
+        def remember!(device:, actor:, factor: SECOND_FACTOR, expiry: LIFETIME)
+          return nil if device.nil? || actor.nil?
+
+          record = find_or_initialize_by(device: device, actor: actor, factor: factor.to_s)
+          record.update!(satisfied_at: Time.current, expires_at: expiry.from_now)
+          record
+        end
+
+        def satisfied?(device:, actor:, factor: SECOND_FACTOR)
+          return false if device.nil? || actor.nil?
+
+          live.exists?(device: device, actor: actor, factor: factor.to_s)
+        end
+
+        def forget!(actor:, factor: SECOND_FACTOR)
+          where(actor: actor, factor: factor.to_s).delete_all
+        end
+      end
+
+      def expired?
+        expires_at <= Time.current
+      end
+    end
+  end
+end